Privacy Policy

1. Information we collect

Information you provide:

• Account details — your email address, display name, and password (stored only as a secure hash).
• Security settings — if you enable two-factor authentication, an encrypted authenticator secret and hashed recovery codes.
• Email preferences — your email address and whether you have chosen to opt out of non-transactional email.
• Content you submit — lab feedback, votes, and broken-lab reports.
• Lab submissions you upload for grading (your CML export / device configurations), and configs you paste into the free /try grading demo — used to grade your work against the answer key.
• Subscription and purchase information, if and when you subscribe or buy paid labs or bundles. Card payments are handled by our payment processor, Stripe — we do not receive or store your full card number.

Information collected automatically:

• Usage and download activity — which labs you view, complete, and download.
• Technical data — your IP address and browser/device information, recorded in our server logs.
• Cookies needed to keep you signed in and to complete two-factor sign-in (described below).

2. How we use your information

• To provide and operate the Service, including your account and downloads.
• To authenticate you and secure your account (two-factor authentication, blocking abusive accounts, rate limiting).
• To watermark each download with a unique identifier and to investigate and act on misuse, such as unauthorized redistribution. This may involve associating a leaked file with the account, email, and IP address that downloaded it.
• To send transactional email (such as account, security, and purchase messages), and to send account, onboarding, reminder, and other notification emails to members. Transactional email always sends; you can opt out of the non-transactional messages at any time using the unsubscribe link in any such email or from your account settings.
• To process purchases and grant access to paid content.
• To maintain, improve, and protect the Service, and to comply with legal obligations.

3. Cookies

We use a small number of essential cookies only — to keep you signed in, to carry a short-lived two-factor sign-in challenge, to remember a device you choose to trust, and to display your recovery codes once. We do not use advertising or third-party tracking cookies.

4. How we share information

We do not sell your personal information. We share it only as needed to run the Service:

• With service providers who act on our behalf — for example, an email delivery provider (for verification and notification emails) and our payment processor, Stripe (for subscriptions and purchases). They may process your information only to provide those services to us.
• To comply with the law, enforce our Terms, or protect the rights, safety, and property of Goldfish Networks, our users, or others.
• In connection with a merger, acquisition, or sale of assets, in which case we will continue to protect your information consistent with this Policy.

Lab content is generated using AI providers; this process does not use your personal information.

5. Data retention

We keep account information for as long as your account is active and as needed to provide the Service. Server logs are retained for a limited period for security and troubleshooting. Because watermarking and anti-piracy protection depend on it, we may retain download and watermark records — including the associated email address and IP address — for as long as necessary to protect our rights and investigate misuse, which may be after your account is closed.

6. Security

We protect your information with measures including encrypted connections (HTTPS), hashed passwords, encrypted two-factor secrets, two-factor authentication, and access controls limiting who can reach administrative data. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

7. Your choices & rights

• You can view and update your account details, and manage your two-factor and notification settings, from your account.
• You can opt out of non-transactional email (account, onboarding, reminder, and other notifications) at any time via the unsubscribe link in any such email or from your account settings; transactional email always sends.
• You may request access to, correction of, or deletion of your personal information by contacting us; note that we may retain certain records as described in Section 5.
• Depending on where you live, you may have additional rights under laws such as the EU/UK GDPR or the California Consumer Privacy Act (CCPA) — including rights to access, delete, or port your data, and to not be discriminated against for exercising them. We do not sell personal information. To exercise any right, contact us at the address below.

8. Children’s privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.

9. Where your information is processed

Goldfish Networks is operated from the United States, and your information is processed and stored in the United States. If you access the Service from outside the U.S., you consent to that processing.

10. Changes to this Policy

We may update this Policy from time to time. Material changes will be reflected by updating the “Last updated” date above. Your continued use of the Service after changes take effect means you accept the updated Policy.

11. Contact

Questions or requests about your privacy? Contact us at support@goldfishnetworks.com.